The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

mkdir "number" mailscanner issue

Discussion in 'E-mail Discussions' started by Mycool, Dec 20, 2007.

  1. Mycool

    Mycool Member
    PartnerNOC

    Joined:
    Dec 5, 2007
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    1
    Hi Guys,

    Having issues with a server. Mail scanner is unable to work as it can no longer as of this morning create dirs that are purely numeric. I have logged into shell and tried also as root and it fails.

    It cant #mkdir 5

    it will #mkdir 54bob or #mkdir bob54

    The issue is only with numeric only dir names.

    We are running CentOS 4.6 and WHM 11.11.0 cPanel 11.16.0-C18528

    I so far have not been able to get much out of google.

    The actual mailscanner error is:
    cannot create temporary Work Dir /var/mstmp/26688. Are the permissions and ownership of /var/spool/MailScanner/incoming correct

    The dir exists and its perms are correct. Mailscanner can create the spamassassin files in that dir.

    The exact response for #mkdir 5 is:
    mkdir: cannot create directory `5': No such file or directory

    Any ideas?
     
  2. cPanel Scott

    cPanel Scott cPanel Systems Engineering Manager
    Staff Member

    Joined:
    Jul 31, 2007
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    1
    Hi!
    Las time I saw this behavior, it was a compromise. See if you can create the directory using something other than /bin/mkdir. Maybe a quick perl script:

    Code:
    #!/usr/bin/perl
    
    mkdir('5') or die("No mkdir: $!\n");
    
    and see what that returns. If that's returning the same thing, and you're sure that the error doesn't make sense, then you may want to consider a root-level compromise.

    I hope this help,

    Scott O'Neil
    Systems Administrator, cPanel
     
  3. Mycool

    Mycool Member
    PartnerNOC

    Joined:
    Dec 5, 2007
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    1
    Any more suggestions on this one?

    Thanks
     
  4. Mycool

    Mycool Member
    PartnerNOC

    Joined:
    Dec 5, 2007
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    1
    To add,

    We have scanned the server with several rootkit scanners and not as yet found anything.

    Please advise of any rootkit utilities that may identify the issue. We have used rootkit hunter and chkrootkit

    Thanks
     
  5. madan.cpanelnet

    madan.cpanelnet Well-Known Member

    Joined:
    Apr 1, 2006
    Messages:
    69
    Likes Received:
    0
    Trophy Points:
    6
    Location:
    INDIA
    Mycool,


    We had the same problem and ended up in OS relaod, it seems to be some unexplored rootkit. Can you please tar your entire /bin and /sbin folder on the affected and uplaod it at some location? I will have it checked by someone.


    Thanks
     
  6. testtubebaby

    testtubebaby Member

    Joined:
    Jul 28, 2007
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    1
    We had the same problem .. and had to os reload.. hostnames chaning automatically.. process like mount or hostname running in ps. Any solution would be appreciated
     
Loading...

Share This Page